Cisco ASA Series Cli Configuration Manual page 1275

Chapter 1 Configuring Cisco Mobility Advantage
Trust Relationships for Cisco UMA Deployments
To establish a trust relationship between the Cisco UMC client and the ASA, the ASA uses the Cisco
UMA server certificate and keypair or the ASA obtains a certificate with the Cisco UMA server FQDN
(certificate impersonation). Between the ASA and the Cisco UMA server, the ASA and Cisco UMA
server use self-signed certificates or certificates issued by a local certificate authority.
Figure 1-3
UMA server has already enrolled with a third-party CA, you can import the certificate with the private
key onto the ASA. Then, the ASA has the full credentials of the Cisco UMA server. When a Cisco UMA
client connects to the Cisco UMA server, the ASA intercepts the handshake and uses the Cisco UMA
server certificate to perform the handshake with the client. The ASA also performs a handshake with the
server.
Figure 1-3
Cisco UMC Client
Figure 1-4
deployment, because each component of the deployment has been newly installed. The ASA enrolls with
the third-party CA by using the Cisco UMA server FQDN as if the ASA is the Cisco UMA server. When
the Cisco UMA client connects to the ASA, the ASA presents the certificate that has the Cisco UMA
server FQDN. The Cisco UMA client believes it is communicating to with the Cisco UMA server.
shows how you can import the Cisco UMA server certificate onto the ASA. When the Cisco
How the Security Appliance Represents Cisco UMA – Private Key Sharing
Internet
TLS (Cisco UMA Certificate)
Key 1
shows another way to establish the trust relationship.
Information about the Cisco Mobility Advantage Proxy Feature
3rd Party CA
Certificate
Authority
Certificate
ASA
TLS (Self-signed,
Inspected and
or from local CA)
Modified
Key 2
(if needed)
Figure 1-4
Cisco ASA Series CLI Configuration Guide
Enroll with FQDN
of Cisco UMA
Cisco UMA
Certificate with
Private Key
shows a green field
1-5